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ABSTRACT 

Social  network  monitoring  is  the  application  of  statistical  process  control  charts  to 
changing  social  network  measures  over  time.  Quality  engineers  use  control  charts  to 
detect  slight  changes  in  industrial  manufacturing  processes.  Once  detected,  the  quality 
engineer  will  identity  a  maximum  likely  change  point,  when  the  process  began  to  change, 
and  search  for  the  specific  cause  of  the  change.  These  tools  allow  quality  engineers  to 
quickly  identify  changes  before  they  cause  significant  financial  loss  to  the  manufacturing 
company.  In  the  same  manner,  analysts  can  use  control  charts  to  detect  slight  changes  in 
dynamic  social  network  measures. 

A  cumulative  sum  (CUSUM)  control  chart  is  applied  to  a  dynamic  social  network 
data  set  of  the  Al-Qaeda  terrorist  organization.  The  data  set  ranges  from  1988  to  2004. 
The  CUSUM  identifies  a  shift  in  several  network  measures  in  the  Al-Qaeda  network 
between  2000  and  2001 .  The  CUSUM  most  likely  change  point  for  all  measures  is  1997. 
This  example  suggests  that  if  analysts  were  to  use  social  network  monitoring  to  monitor 
terrorist  networks,  dangerous  shifts  in  the  network  might  be  detected  before  they  become 
a  problem.  Furthermore,  the  specific  cause  of  change  could  be  identified,  allowing 
analysts  to  exploit  positive  changes  in  a  terrorist  organization  and  mitigate  negative 
changes. 


INTRODUCTION 

Social  network  analysis  (SNA)  is  the  mathematical  methodology  of  quantifying 
relationships  between  inividual  people  or  organizations.  SNA  considers  individuals  or 
groups  as  nodes  in  a  graph,  while  relationships  between  nodes  are  graph  edges.  There 
can  exist  many  different  types  of  relationships,  such  as  communication,  finance,  religion, 
or  nationality.  This  methodology  offers  a  wealth  of  potential  tools  for  military 
intelligence  and  the  war  on  terror. 

The  Office  of  Naval  Research  (ONR)  collected  and  maintains  social  network  data 
on  the  Al-Qaeda  terrorist  network.  This  data  includes  many  different  relationships  to 
include  communication,  financial,  physical,  etc.  The  data  set  begins  with  intelligence 
collected  in  1988  and  includes  consecutive  years  through  2004.  Using  this  data  and  SNA 
methods,  analysts  are  able  to  calculate  and  quantify  the  most  influential  terrorists  in  the 
network,  the  most  knowledgable,  individuals  that  connect  separate  subsections  within  the 
group,  and  much  more.  While  it  is  important  to  understand  terrorist  organizations  from 
an  SNA  perspective,  it  does  not  necessarily  identify  critical  changes  in  social  network 
structure  over  time. 
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Statistical  process  control  charts  may  be  useful  in  monitoring  social  networks  for 
important  changes  over  time.  Control  charts  are  used  by  quality  engineers  in  industry  to 
monitor  manufacturing  processes  for  changes  to  important  quality  characteristics.  The 
quality  engineer  records  observations  of  a  specified  quality  measure  and  calculates  an 
appropriate  statistic.  He  then  compares  the  statistic  to  a  control  limit.  If  the  statistic 
exceeds  the  contol  limit,  the  chart  is  said  to  "signal"  that  there  may  have  been  a  change  to 
the  quality  characteristic  that  is  being  monitored.  The  quality  engineer  will  then  inspect 
the  process  to  see  if  it  is  out  of  calibration,  before  the  process  continues  to  produce 
product  that  is  outside  quality  specifications.  He  then  corrects  the  process  if  necessary; 
and  begins  to  search  for  the  specific  cause  of  the  signal.  Some  control  chart  algorithms 
offer  an  estimate  of  when  the  process  fell  "out-of-control".  The  saves  time  in  identifying 
the  specific  cause  of  the  signal.  These  same  control  chart  algorithms  can  be  applied  to 
SNA  measures  observed  on  networks  collected  over  time.  Instead  of  observing  quality 
characteristics,  however,  normally  distributed  network  measures  are  used. 

A  cumulative  sum  (CUSUM)  control  chart  is  a  commonly  used  statistic  in  quality 
engineering  that  offers  an  estimate  of  when  the  observed  process  changes.  The  CUSUM 
statistic  is  therefore  applied  to  several  normally  distributed  measures  from  the  ONR  Al- 
Qaeda  SNA  data  fi'om  1988-2004.  Using  an  arbitrary  control  limit,  the  control  chart  is 
able  to  successfiilly  predict  changes  to  the  Al-Qaeda  network  prior  to  their  terrorist 
attacks  of  September  1 1  th, 


CUSUM  STATISTIC 

The  CUSUM  control  chart  is  a  widely  used  control  chart  derived  from  the 
sequential  probability  ratio  test  (SPRT)  (Page,  1961).  The  SPRT  was  derived  from  the 
Neyman  and  Pearson  (1 933)  most  powerful  test  for  a  simple  hypothesis.  Neyman  and 
Pearson’s  test  statistic  is 


- -  (2.1) 


Neyman  and  Pearson  showed  that  the  most  powerful  test  of  Ho  against  Ht  is  obtained  by 
rejecting  Ho  if  A,>  /C  and  concluding  in  favor  of  Ho  if  A,  <  K,  where  K  is  determined  by 
the  level  of  significance,  a.  The  level  of  significance  is  the  probability  that  Ho  is  rejected 
when  it  is  true. 

Wald  (1947)  demonstrated  that  the  Neyman  and  Pearson  hypothesis  testing 
method  could  be  applied  sequentially  and  could  significantly  reduce  the  number  of 
samples  required  to  reach  a  conclusion.  Wald’s  sequential  probability  ratio  test  (SPRT) 
compares  K,  to  two  constants  A  and  B  where  0  <B  <  A  <oo.  Observations  are  collected 
and  examined  one-at-a-time.  After  the  /***  observation  there  are  three  possible  outcomes. 


If  A,  <  B,  then  the  test  concludes  in  favor  of  Ho,  If  A,  >  A,  then  Ho  is  rejected  in  favor 
of  //i .  If  5  <  A,  <  ^  then  sampling  will  continue  with  observation  /  +  1 . 

The  SPRT  can  be  used  to  test  H„\^  =  against  //, :  //  =  //,  tor  normal  means. 

Without  loss  of  generality  we  will  assume  that  Mo-  Having  observed  t  observations, 
the  SPR  is 
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This  can  be  reduced  algebraically  to 
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The  sequential  probability  ratio,  A, ,  is  compared  to  appropriate  constants  A  and  B  as  each 
new  observation  t  is  formed.  Following  observation  t,  the  test  concludes  in  favor  of  Ho  if 
Aj.  <  B.  If  Aj.  >  v4,  then  the  test  concludes  in  favor  of  Hi.  lfB<  Aj.  <  A,  then  sample  t  + 
1  is  obtained  and  a  revised  A^^,  is  computed.  This  procedure  continues  until  either  A,  <B 
or  A,  >  A. 

In  a  Social  Network  Monitoring  (SNM)  application  of  the  SPRT,  fio  is  the  mean 
of  a  social  network  measure  and  jxi  is  the  mean  after  a  change  in  the  network.  Since  one 
would  never  conclude  in  favor  of  //<,  that  the  network  is  unchanged  and  stop  all  sampling, 
the  procedure  continues  until  it  signals  that  there  is  a  change  in  the  network.  This 
implementation  of  the  SPRT  procedure  leads  to  the  CUSUM  control  chart. 

The  CUSUM  control  chart  is  based  on  cumulative  sums  of  a  network  measure 
over  time  and  is  derived  from  the  sequential  probability  ratio  test  (SPRT).  In  a  control 
chart  application  of  the  SPRT,  one  would  continue  to  monitor  the  network  until  A,  >  ^ 

when  the  procedure  signals  that  there  is  a  change  in  the  network.  The  SPRT  leads  to  the 
following  expression  for  detecting  an  increase  in  the  mean  of  a  normally  distributed 
network  measure.  The  procedure  would  signal  when 
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This  expression  can  be  simplified  by  taking  the  natural  logarithm  of  both  sides  of  the 
inequality, 
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This  decision  rule  can  be  algebraically  reduced  to 
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By  allowing //[  =  //q  +  ^xi  procedure  signals  when 
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where  <5  is  the  standardized  difference  in  the  network  measure  under  Ho  and  Hi.  This 
decision  rule  can  then  be  further  simplified  by  using  the  cumulative  statistic 

C,  whereZ.  =(x. -/i^)/cr-,  and  k  =  S/2,  The  common  choice  of^in 

quality  applications  is  0.5,  which  corresponds  to  a  standardized  magnitude  of  change  in 
mean  of  5  =  1.  Thus,  observations  are  examined  sequentially  until  C,  >  A' . 

The  CUSUM  sequentially  compares  the  statistic  C,  against  a  control 
limits'  until  Cl  >  A' ,  Since  one  is  not  interested  in  concluding  that  the  network  is 
unchanged,  the  cumulative  statistic  is 


c;  =  max  {0,  Zi-k  +  c;_, } .  (2.4) 


If  this  rule  was  not  implemented  the  control  chart  would  require  more  subgroups  to  signal 
if  Cl  <  0.  The  statistic  C*  is  compared  to  a  constant,  h^.  If  C^  >h* ,  then  the  control 

chart  signals  that  an  increase  in  a  network  measure  has  occurred. 

A  required  assumption  for  the  derivation  of  the  CUSUM  statistic  is  that  the 
network  measure  under  observation  is  normally  distributed.  There  is  still  much  work  to 
be  done  in  the  area  of  classifying  the  probability  space  of  a  social  network.  However,  the 
central  limit  theorem  does  allow  us  to  understand  the  distribution  of  a  sample  average  of 
30  or  more  observations.  Therefore,  network  measures  that  are  averaged  over  30  or  more 
nodes  will  have  a  normally  distributed  measure.  Some  of  the  measures  that  have  been 
investigated  include  the  Average  Betweenness,  Average  Closeness,  Average  Degree,  and 
Average  Eigenvector  Centrality. 

For  ^  <0,  the  SPRT  similarly  leads  to  the  CUSUM  procedure  for  detecting  a 
decrease  in  a  network  measure.  In  this  case,  C~  =  max  {0,  -  Z,  -  ^  }  is  compared  to 

a  constant,  h~ .  If  CJ  >  h" ,  then  the  control  chart  signals  that  a  decrease  in  a  network 
measure  has  occurred. 


To  monitor  for  both  increases  and  decreases  in  the  mean,  two  one-sided  control 
charts  are  employed.  One  chart  is  used  for  monitoring  for  increases  in  the  mean  of  a 
network  measure  and  the  other  is  used  for  detecting  decreases  in  mean.  If  the  process 
remains  in-control,  Cf  will  fluctuate  around  zero.  If  there  is  an  increase  in  the  mean  of  a 

network  measure,  C*  will  tend  to  increase.  Conversely,  if  there  is  a  decrease,  then  C~ 
will  tend  to  increase.  When  C*  >  or  C~  >  h',  the  two  one-sided  CUSUM  control 

chart  scheme  signals  that  the  process  is  out-of-control. 

The  CUSUM  control  chart’s  ability  to  detect  changes  has  been  extensively 
investigated  in  the  literature.  Lorden  (1971)  introduced  a  minimax  criteria  that 
minimizes  the  average  number  of  observations  to  detect  a  change,  subject  to  a  given 
probability  of  false  alarms.  He  also  proposed  the  use  of  a  maximum  likelihood  approach 
to  rapidly  detect  changes  in  a  process.  Lorden’s  approach  does  better  than  the  CUSUM 
at  detecting  a  wide  range  of  changes  in  the  mean  of  a  process,  but  does  not  completely 
outperform  the  CUSUM  for  all  potential  changes  in  the  process  mean. 

Moustakides  (1986)  proved  that  Page’s  CUSUM  control  chart  will  detect  a 
specific  standardized  step  change  in  the  mean  of  a  measure  with  fewer  subgroups  than 
any  other  statistical  test.  The  specific  step  change  in  mean  is  a  standardized  change  of  S 
=  2k,  where  k  is  the  control  chart  parameter  in  Equation  2.4.  Therefore,  the  CUSUM 
control  chart  is  the  best  chart  to  use  for  detecting  a  standardized  change  in  mean  of  S  = 

2k.  However,  other  control  charts  may  detect  other  changes  in  the  mean  with  fewer 
subgroups.  Several  attempts  to  improve  upon  the  CUSUM  control  chart  have  been 
investigated  in  the  literature.  However,  the  CUSUM  is  used  to  demonstrate  the  general 
applicability  of  control  charts  in  dynamic  social  network  analysis,  due  to  its  simplicity 
and  versatility. 


RESULTS 

Social  network  measures  were  plotted  for  number  of  agents,  average  degree, 
average  betweenness,  average  closeness,  average  eigenvector  centrality,  and  density. 
Each  of  these  network  measures  were  increasing  from  1988  until  1994.  The  measures 
then  leveled  off.  There  are  many  possible  reasons  for  this  bum-in  period,  the  least  of 
which  is  the  quality  of  intelligence  gathering  on  Al-Qaeda.  For  this  reason,  the  average 
measure  and  standard  deviation  were  calculated  over  five  years  beginning  in  1 994.  The 
CUSUM  control  chart  was  used  to  monitor  the  five  measures  above  from  1994  to  2004. 
Figure  1  displays  the  plot  of  the  social  network  measure  for  the  average  closeness  of 
members  in  the  Al-Qaeda  network.  The  reference  value,  k,  and  the  control  limit,  h,  were 
arbitrarily  set  at  0.5  and  4  respectively  for  all  of  the  social  network  control  charts.  Figure 
2  shows  the  CUSUM  statistic  for  the  average  closeness  that  is  plotted  in  Figure  1 .  It  can 
be  seen  that  the  CUSUM  statistic  in  Figure  2  is  a  more  dramatic  indication  of  network 
change  than  simply  monitoring  the  network  measure  in  Figure  1 .  This  is  a  result  of  the 
CUSUM  statistic  taking  into  account  previous  observations  of  the  network.  A  single 
observation  of  a  network  measure  that  is  slightly  higher  than  normal  may  not  indicate  a 
change  in  the  network.  Multiple  observations  that  are  slightly  higher  than  normal, 
however,  may  indicate  a  shift  in  the  mean  of  the  measure. 


FIGURE  I  ABOUT  HERE 


FIGURE  2  ABOUT  HERE 

Recall  that  the  CUSUM  will  either  detect  increases  or  decreases  in  a  measure,  but  not 
both.  Therefore,  two  control  charts  must  be  run  for  each  social  network  measure  being 
monitored.  On  chart  is  used  for  increases  and  the  other  chart  for  decreases.  Table  1 
displays  the  CUSUM  statistic  values  for  detecting  increases  in  a  measure,  while  table  2 
shows  the  values  for  decreases  in  a  measure. 

TABLE  1  ABOUT  HERE 

The  control  chart  will  signal  a  false  alarm  after  168  observations  on  average  when 
the  control  limit  is  arbitrarily  set  to  /i  =  4  (McCulloh,  2004).  This  corresponds  to  a 
probability  of  false  alarm  of  less  than  1%.  It  can  be  seen  in  Table  1  that  the  CUSUM 
statistic  exceeds  the  control  limit  of  4  and  signals  that  there  might  be  a  significant  change 
in  the  Al-Qaeda  network  in  either  2000  or  2001  for  all  five  measures.  Therefore,  an 
analyst  monitoring  Al-Qaeda  would  be  alerted  to  a  critical,  yet  subtle  change  in  the 
network  prior  to  the  September  1 1  terrorist  attacks. 

TTie  CUSUM  control  chart  also  has  a  built  in  feature  for  determining  the  most 
likely  time  that  the  change  occurred.  This  time  is  identified  as  the  last  point  in  time  when 
the  CUSUM  statistic  is  equal  to  0.  For  all  measures,  this  point  in  time  is  1997.  To 
understand  the  cause  of  the  change  in  the  Al-Qaeda  network,  an  analyst  should  look  at 
events  occurring  in  1997. 

Several  very  interesting  events  related  to  Al-Qaeda  and  Islamic  extremism 
occurred  in  1 997.  Six  Islamic  militants  massacred  58  foreign  tourists  and  at  least  four 
Egyptians  in  Luxor,  Egypt.  Coalition  forces  deployed  to  Egypt  in  1997  for  a  bi-annual 
training  exercise  were  repeatedly  attacked  by  Islamic  militants.  The  coalition  suffered 
numerous  casualties  and  shortened  their  deployment.  In  early  1998,  Zawahiri  and  Bin 
Laden  were  publicly  reunited,  although  based  on  press  release  timings,  they  must  have 
been  working  throughout  1997  planning  future  terrorist  operations.  In  February  of  1998, 
an  Arab  newspaper  introduced  the  “International  Islamic  Front  for  Combating  Crusaders 
and  Jews.”  This  organization,  established  in  1 997,  was  founded  by  Bin  Laden,  Zawahiri, 
leaders  of  the  Egyptian  Islamic  Group,  the  Jamiat-ul-Ulema-e-Pakistan,  and  the  Jihad 
Movement  in  Bangladesh,  among  others.  The  Front  condemned  the  sins  of  American 
foreign  policy  and  called  on  every  Muslim  to  comply  with  God’s  order  to  kill  the 
Americans  and  plunder  their  money.  Six  months  later  the  US  embassies  in  Tanzania  and 
Kenya  were  bombed  by  Al-Qaeda.  Essentially,  1997  was  possibly  the  most  critical  year 
in  uniting  Islamic  militants  and  organizing  Al-Qaeda  for  offensive  terrorist  attacks 
against  the  United  States. 

Table  2  shows  similar  results  for  detecting  decreases  in  network  measures.  The 
control  chart  for  all  measures  signals  a  possible  network  change  in  2003.  The  most  likely 
time  that  this  change  occurred  was  2001,  which  corresponds  to  the  U.S.  invasion  of 
Afghanistan. 


TABLE  2  ABOUT  HERE 


CONCLUSIONS 


Control  charts  are  a  critical  quality  engineering  tool  that  assists  manufacturing 
firms  maintain  profitability.  This  Al-Qaeda  example  demonstrates  that  social  network 
monitoring  could  enable  analysts  to  detect  important  changes  in  terrorist  networks. 
Furthermore,  the  most  likely  time  that  the  change  occurred  can  also  be  detected.  This 
paper  does  not  mean  to  imply  that  the  CUSUM  statistic  is  the  answer  to  social  network 
monitoring.  The  CUSUM  is  simply  used  to  illustrate  the  usefulness  of  a  statistical 
process  control  chart  for  monitoring  social  networks.  There  are  many  other  control  chart 
statistics  that  could  be  used  to  monitor  a  dynamic  social  network.  More  research  in  this 
area  is  needed  to  characterize  the  nature  of  dynamic  social  networks,  and  to  identify  what 
statistics  are  best  to  minimize  the  probability  of  false  alarms  and  increase  the  speed  of 
detecting  changes. 

Future  research  in  social  network  monitoring  should  also  focus  on  friendly 
organizations  as  opposed  to  terrorist  networks.  Although  understanding  terrorism  is  an 
important  application  of  social  network  monitoring,  there  is  always  a  great  amount  of 
unknown  information  in  terrorist  organizations.  The  terrorist  are  just  not  good  at  filling 
out  the  surveys  required  to  understand  the  true  social  network.  Friendly  organizations,  on 
the  other  hand,  provide  researchers  the  opportunity  to  monitor  all  social  connections,  and 
through  surveys  and  interviews,  understand  why  those  connections  exist  and  when  they 
change. 

With  a  better  understanding  of  social  network  monitoring,  there  is  a  wide  range  of 
potential  applications.  Intelligence  analysts  can  better  monitor  terrorist  organizations. 
Military  commanders  can  have  improved  situational  awareness  of  their  units  by 
monitoring  communications  among  subordinates  and  linking  the  communication  network 
to  morale  and  motivation.  Civilian  business  leaders  can  monitor  the  success  and  progress 
of  strategic  combinations,  such  as  mergers  and  acquisitions.  Most  application  areas  of 
dynamic  network  analysis  can  make  use  of  social  network  monitoring  to  detect  and 
identify  changes  in  a  dynamic  social  network. 
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Figure  2.  CUSUM  Control  Chart  for  Average  Closeness  of  At-Qaeda 


Table  1 

1.  CUSUM  Statistic  for  Del 

tecting  Increases  in  a  Network  Measure 

1994 

1995 

1996 

1997 

1998 

1999 

2000 

2001 

2002 

2003 

2004 

Number 

Agents 

0.00 

0.00 

0.00 

0.00 

1.19 

2.12 

3.43 

4.99 

2.18 

0.00 

0.00 

Average 

Centrality 

0.00 

0.60 

0.00 

0.00 

1.19 

6.10 

9.24 

4.39 

0.00 

0.00 

Average 

0,00  i 

0.43 

0.00 

0.00 

2.02 

■cWl 

5.26 

8.46 

5.31 

0.00 

0.00 

Betweenness 

Average 

Closeness 

0.00 

0.59 

0.00 

0.00 

1.25 

1.84 

3.74 

6.95 

3.61 

0.00 

0.00 

Average 

Density 

0.00 

0.60 

0.00 

0.00 

1.19 

3.74 

6.10 

9.24 

4.39 

0.00 

0.00 

Table  2.  CUSUM  Statistic  for  Detecting  Decreases  in  a  Network  Measure 


